security: enforce frozen lockfile in Docker builds

[bolaji-ai]

Summary

Hardens Docker builds against npm supply chain attacks by enforcing lockfile-pinned installs.

Changes:

•  ERR_PNPM_NO_PKG_MANIFEST  No package.json found in /Users/ibrobaba/CodeStuff/Cohere/secops →  ERR_PNPM_NO_PKG_MANIFEST  No package.json found in /Users/ibrobaba/CodeStuff/Cohere/secops
• →
• Add explicit where missing

Why: During the axios supply chain attack (2026-03-31), was briefly live on npm. Bare /  ERR_PNPM_NO_PKG_MANIFEST  No package.json found in /Users/ibrobaba/CodeStuff/Cohere/secops without can silently resolve to a newer version than what's in the lockfile if someone runs with or if the lockfile is absent from the build context. / makes the build fail if the lockfile is missing or inconsistent.

Related: Cohere internal report: axios-supply-chain-attack-2026-03-31

[cla-assistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}